npm detections from LPM Firewall.

The package is a browser payload, not a normal npm library: opening its main entrypoint causes remote code execution and automatic browser traffic/cookie proxying. This is concrete malici...

Direct inspection confirms runtime remote-code loading and a service-worker proxy/cookie transport, not merely scanner heuristics. Although no npm lifecycle hook runs at install, the brow...

The source establishes an automatic remote code-execution path in the packaged entry page, compounded by automatic service-worker/proxy setup. No install hook is required for the maliciou...

The package has no install-time hook, but its declared runtime entrypoint directly executes third-party remote code and installs an intercepting service-worker proxy. That is concrete mal...

No install-time behavior was found, but the shipped browser entrypoint loads a remote third-party script and configures an opaque proxied browsing stack that can handle request data. Thes...

No install hook affects the host, but runtime source confirms remote executable loading and an obfuscated service-worker proxy that relays request data. This is a concrete unsafe payload...

This is not merely a static hint: direct source inspection confirms an unconditional remote script execution path from the declared entrypoint. The lack of npm lifecycle hooks limits inst...

Direct execution of an unpinned, unrelated remote script is a concrete remote-payload chain, not merely a static heuristic. The absence of npm lifecycle hooks does not mitigate runtime br...

This package does not execute during npm installation, but its declared runtime entrypoint grants an unrelated remote host arbitrary code execution. That is a concrete, unconsented remote...

This is not an ordinary npm library: its only entrypoint is an HTML app that loads unpinned remote code and installs a service worker to proxy traffic to unrelated remote infrastructure....

No install hook runs, but the declared entrypoint immediately delegates code execution to an unrelated remote domain and sets up persistent browser request interception. That is concrete...

This package has no install hook, but its declared browser entrypoint contains a concrete, automatically activated remote-code and traffic-interception chain. The external executable scri...

Source inspection confirms immediate third-party remote code loading and a service-worker proxy transport. No install hook is needed for the package to create a harmful runtime attack sur...

Static source inspection confirms an automatic unpinned remote script load and automatic service-worker proxy setup. These are concrete runtime control surfaces despite the absence of npm...

Although no install hook executes, the shipped browser entrypoint immediately loads remote code and deploys a cookie-aware request proxy when opened. That is concrete malicious runtime be...

Source inspection confirms an unconsented postinstall write to a foreign host project's AI-agent configuration surface. This meets the install-control-surface block boundary even though n...

This is concrete import-time arbitrary-code execution concealed behind encrypted payloads, not a normal blockchain SDK capability. The absence of an install hook does not mitigate executi...

Direct inspection confirms an unconsented `postinstall` credential-exfiltration chain. The package contains no source functionality that would justify collecting and transmitting CI secrets.

Direct inspection of the sole package file confirms an automatic install-time AWS credential-exfiltration chain. This is concrete malicious behavior, not a scanner-only inference.

The source contains a concrete import-time remote-code-execution chain, not merely a suspicious primitive. Lack of an install hook does not mitigate execution when the package is loaded b...